CI/CD Integration

The platform provides an API and specialized tools to perform quick, one-off security tests during the development cycle. The objective is to allow engineering teams to validate code security in staging or production environments immediately after deployment, automating security quality control.

Key Features

Regardless of the CI/CD tool used, the solution offers a set of essential features for automation:

• Target Validation (Check): Before starting the test, the system validates whether the URL is accessible and if the organization has the necessary permissions and "run minutes" to test it, preventing errors in pipeline execution.

  • Endpoint: POST /v1/jobs/check

• Test Launch: Initiates a security test on a specific URL. Allows the test to be associated with specific contexts for traceability. Note: the requested asset should be in the scope of a running Continuous Test.

  • Endpoint: POST /v1/jobs/launch

• Blocking Criteria ("Break the Build"): Allows checking the success of the test based on the severity of vulnerabilities found. The pipeline can be configured to fail automatically if vulnerabilities above a certain risk level (e.g., Critical or High) are detected.

  • Endpoint: GET /v1/jobs/{job_uuid}/success?severity=high&fail=true
  • Returns 200 OK if safe, 202 Accepted if the test is still running, or 424 Failed Dependency if vulnerabilities exceeding the threshold are found.

• Execution Flexibility: Integration libraries support synchronous execution (the pipeline waits for the test result) or asynchronous ("fire and forget"), where the test is launched without immediately blocking the workflow's progress.

• Cancellation: Ability to interrupt running tests if the deploy process is aborted to save run minutes.

  • Endpoint: POST /v1/jobs/{job_uuid}/cancel

---

Integration Methods

Customers can integrate these functionalities through three main methods:

GitHub Actions (Reusable Action)

For projects hosted on GitHub, there is a Reusable Action (ethiack/github-action) that simplifies configuration via a declarative YAML, with the following capabilities:

• CLI Wrapper: This Action acts as a wrapper for the command-line tool (ethiack-job-manager). Upon execution, the Action automatically configures a Python environment, installs the tool via pipx, and dynamically builds the command based on user inputs.
• Secret Management: Authentication is securely managed by injecting credentials (API Keys) as environment variables into the execution context.
• Flow Control: The Action captures the tool's exit code. If the test fails (for example, due to a critical vulnerability found with the --fail option active), the Action propagates that error, causing the workflow step to fail and preventing the deploy from advancing.

GitLab CI/CD (Component)

For the GitLab ecosystem, integration is done through a CI/CD Component (gitlab-cicd-component), with the following capabilities:

• Isolated Container Execution: Executes within a Python "slim" Docker image, ensuring a lightweight, isolated, and consistent environment for test execution.
• Parameterization: The component accepts inputs defined in .gitlab-ci.yml (such as the pipeline stage, command, and URL).
• Modular Integration: Inclusion is done via the include: component directive, treating the security test as a standardized stage in the pipeline.

Jenkins

A Shared Library written in Groovy is available. This solution communicates directly with the API via native HTTP requests, eliminating the need to install external dependencies on Jenkins agents.

Other Tools

For customised scenarios or other CI/CD tools, customers can use the command-line tool (Python CLI) or the REST API directly.

The API documentation is available at https://api.ethiack.com/docs/#/ and the OpenAPI specification can be downloaded at https://api.ethiack.com/openapi.yaml.